What protects your customers' information

Isolation between businesses

Every record belongs to exactly one business, and that boundary is enforced by PostgreSQL row-level security — the database refuses to return another business’s rows, rather than relying on application code to remember to filter. A browser cannot ask for another account’s data by changing an identifier, because the account is derived from your own session every time.

This is covered by an automated test suite that attempts cross-account reads, writes and updates across every table type, as a non-member and as a read-only user, and asserts that all of them fail.

The AI’s limits are enforced outside the AI

Customers can type anything, including text designed to manipulate an AI assistant. So the assistant’s boundaries are not instructions in a prompt — they are things it structurally cannot do:

• • It has no tool that accepts a phone number, so it cannot text anyone else.
• • Your account identity is supplied by the server, not by the AI.
• • It cannot change prices, settings, billing or consent records.
• • It cannot turn off safety behavior or override an opt-out.
• • Every message it wants to send is re-checked against consent and limits.

Messaging and consent

• • Permission is tracked per contact, channel and purpose, with evidence and timestamps.
• • STOP suppresses messaging immediately and is honored even mid-conversation.
• • Non-urgent automated messages respect 8am–9pm in the recipient’s own time zone.
• • Outbound is US-only, and Canadian or Caribbean numbers are blocked despite sharing +1.
• • Premium-rate and service numbers are blocked outright.
• • Nothing sends until carrier registration is approved.

Spending controls

Messaging and AI cost money, which makes them an attack surface. Spending is reserved before any provider is called and reconciled afterwards, with daily caps per account and across the platform. Limits apply by destination, by account, by telephone exchange, by hour and by day — concurrent requests cannot slip past a cap by arriving at the same moment.

There is also a kill switch that stops all outbound messaging platform-wide.

Data handling

• • Calendar tokens and webhook secrets are encrypted at rest (AES-256-GCM).
• • Message bodies, addresses and contact names are redacted from application logs.
• • Raw IP addresses are not retained; only a salted hash for abuse correlation.
• • Retention windows are configurable per account.
• • Export and deletion requests are supported.
• • Provider cost data is operator-confidential and never exposed to accounts.

Website import

Importing your website means fetching a URL you supply, which is a classic way to attack a server. The fetcher blocks private, loopback, link-local and cloud metadata addresses in both IPv4 and IPv6, resolves the hostname and validates every address it returns, follows redirects one hop at a time revalidating each, and caps response size, time and content type. Scraped page scripts are stripped and never executed.